Is CVE-2026-112085 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112085 being exploited in the wild.

How severe is CVE-2026-112085?

High severity, with a CVSS score of 8.2, published 22 October 2026.

Which products and versions are affected?

Webpack-Dev-Server before 5.2.7 and 6.0.0 to before 6.1.0.

How is CVE-2026-112085 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112085?

Check whether you run Webpack-Dev-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112085: webpack-dev-server origin validation bypass in proxied WebSockets

CVE-2026-112085 · Severity: high · CVSS 8.2 · Published 2026-10-22

webpack-dev-server is a development server that enables live code reloading for JavaScript projects. When configured to proxy WebSocket connections, the server fails to validate the origin of cross-origin WebSocket upgrade requests, allowing a malicious website to access the proxied backend service directly even when the dev server is restricted to localhost. An attacker can read sensitive data from or modify the proxied backend without authorization.

Technologies: Webpack-Dev-Server. Vendors: Webpack.

Quick answers

Is CVE-2026-112085 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112085 being exploited in the wild.
How severe is CVE-2026-112085?: High severity, with a CVSS score of 8.2, published 22 October 2026.
Which products and versions are affected?: Webpack-Dev-Server before 5.2.7 and 6.0.0 to before 6.1.0.
Is there a fix for CVE-2026-112085?: Yes: fixed in webpack-dev-server 5.2.7, 6.1.0. Until then: Omit ws: true from devServer.proxy entries where the proxied API does not require WebSocket forwarding, and scope proxy context to specific paths. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112085 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112085?: Check whether you run Webpack-Dev-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: webpack-dev-server 5.2.7, 6.1.0

Omit ws: true from devServer.proxy entries where the proxied API does not require WebSocket forwarding, and scope proxy context to specific paths.

Technical details

The vulnerability stems from WebSocket upgrade requests bypassing the Host and Origin header validation that normally applies to HTTP requests through the middleware chain. When devServer.proxy is configured with ws: true, non-HMR WebSocket upgrade requests are forwarded directly to the proxy target without the security checks enforced by allowedHosts. An attacker who tricks a developer into visiting a malicious web page can initiate a cross-origin WebSocket connection through the dev server to reach the backend, gaining unauthorized read and write access.

Affected products

webpack webpack-dev-server before 5.2.7 and 6.0.0 to before 6.1.0

Timeline

2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.